Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 21:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b93ac515ba10ba119cf955f35ff09d0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0b93ac515ba10ba119cf955f35ff09d0_NeikiAnalytics.exe
-
Size
115KB
-
MD5
0b93ac515ba10ba119cf955f35ff09d0
-
SHA1
73d1c402d488d0dcc25494405f33a5539f2e2a5a
-
SHA256
a35964b8ef6b54f214b341eec94d913ab2c0f6d492b3ae0fa46d7516aafca18b
-
SHA512
45aa88951c9e59d041d1c20803fba96180aca1a622feeec0e5cea7d52f60189350ed1afc3281b86a1feab6430a5a019b58a1b1379514ce22afb008e2f0ecc137
-
SSDEEP
3072:ymb3NkkiQ3mdBjFosxXGPXbXQMFHLgDWSmjlkFx:n3C9BRosxW8MFHLMWvlu
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2208-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1224-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/860-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1160-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bhbthh.exeddjvd.exerlxfxll.exe1htttb.exehbnhnn.exevpdjv.exeppdjd.exexxlrfrl.exetthhbb.exe7hbbtt.exe7hhbht.exepppdj.exexrflrrf.exefflffxf.exenhthtb.exenthhtb.exeddvvj.exedjpvj.exexxrxlrf.exettnttb.exetnbhnn.exe3tnbnn.exe5vvvv.exejjvpv.exe9llxrxl.exefxrxxrx.exettntnb.exedjjvp.exe3pjjp.exexrxrfrl.exelfrfrlr.exehbbthn.exebtthnn.exeddpdj.exedvjpv.exedvpvj.exexrfllxl.exeflrfllf.exe5nntbb.exehnbtbh.exenhhnth.exedpdjp.exerfrxlrf.exe1fflrfl.exe7nbnbn.exebhnnbt.exedpjpj.exedvpvj.exe5lffrfl.exe1lxxffl.exebtbhtb.exetthhtt.exe3hhnhn.exepjvvj.exepjvdp.exerfrlrrl.exexxlrxfr.exetbhnhb.exehhttbn.exe7jjdp.exe1pjjj.exeffrxflx.exerxrlflf.exetnthth.exepid process 1908 bhbthh.exe 2600 ddjvd.exe 2396 rlxfxll.exe 2640 1htttb.exe 2500 hbnhnn.exe 2448 vpdjv.exe 2980 ppdjd.exe 1504 xxlrfrl.exe 2456 tthhbb.exe 1896 7hbbtt.exe 1628 7hhbht.exe 1604 pppdj.exe 1808 xrflrrf.exe 1684 fflffxf.exe 2300 nhthtb.exe 1160 nthhtb.exe 2040 ddvvj.exe 1904 djpvj.exe 2368 xxrxlrf.exe 596 ttnttb.exe 860 tnbhnn.exe 1596 3tnbnn.exe 1284 5vvvv.exe 2936 jjvpv.exe 1120 9llxrxl.exe 928 fxrxxrx.exe 2840 ttntnb.exe 848 djjvp.exe 2088 3pjjp.exe 3048 xrxrfrl.exe 1224 lfrfrlr.exe 1552 hbbthn.exe 2536 btthnn.exe 2628 ddpdj.exe 2504 dvjpv.exe 2732 dvpvj.exe 2524 xrfllxl.exe 2380 flrfllf.exe 2660 5nntbb.exe 2308 hnbtbh.exe 1256 nhhnth.exe 1456 dpdjp.exe 2400 rfrxlrf.exe 2612 1fflrfl.exe 1896 7nbnbn.exe 2428 bhnnbt.exe 2664 dpjpj.exe 1444 dvpvj.exe 328 5lffrfl.exe 632 1lxxffl.exe 2196 btbhtb.exe 3000 tthhtt.exe 2120 3hhnhn.exe 1988 pjvvj.exe 2316 pjvdp.exe 448 rfrlrrl.exe 584 xxlrxfr.exe 860 tbhnhb.exe 1072 hhttbn.exe 2076 7jjdp.exe 856 1pjjj.exe 3024 ffrxflx.exe 1068 rxrlflf.exe 1648 tnthth.exe -
Processes:
resource yara_rule behavioral1/memory/2208-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/860-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1160-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-46-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0b93ac515ba10ba119cf955f35ff09d0_NeikiAnalytics.exebhbthh.exeddjvd.exerlxfxll.exe1htttb.exehbnhnn.exevpdjv.exeppdjd.exexxlrfrl.exetthhbb.exe7hbbtt.exe7hhbht.exepppdj.exexrflrrf.exefflffxf.exenhthtb.exedescription pid process target process PID 2208 wrote to memory of 1908 2208 0b93ac515ba10ba119cf955f35ff09d0_NeikiAnalytics.exe bhbthh.exe PID 2208 wrote to memory of 1908 2208 0b93ac515ba10ba119cf955f35ff09d0_NeikiAnalytics.exe bhbthh.exe PID 2208 wrote to memory of 1908 2208 0b93ac515ba10ba119cf955f35ff09d0_NeikiAnalytics.exe bhbthh.exe PID 2208 wrote to memory of 1908 2208 0b93ac515ba10ba119cf955f35ff09d0_NeikiAnalytics.exe bhbthh.exe PID 1908 wrote to memory of 2600 1908 bhbthh.exe ddjvd.exe PID 1908 wrote to memory of 2600 1908 bhbthh.exe ddjvd.exe PID 1908 wrote to memory of 2600 1908 bhbthh.exe ddjvd.exe PID 1908 wrote to memory of 2600 1908 bhbthh.exe ddjvd.exe PID 2600 wrote to memory of 2396 2600 ddjvd.exe rlxfxll.exe PID 2600 wrote to memory of 2396 2600 ddjvd.exe rlxfxll.exe PID 2600 wrote to memory of 2396 2600 ddjvd.exe rlxfxll.exe PID 2600 wrote to memory of 2396 2600 ddjvd.exe rlxfxll.exe PID 2396 wrote to memory of 2640 2396 rlxfxll.exe 1htttb.exe PID 2396 wrote to memory of 2640 2396 rlxfxll.exe 1htttb.exe PID 2396 wrote to memory of 2640 2396 rlxfxll.exe 1htttb.exe PID 2396 wrote to memory of 2640 2396 rlxfxll.exe 1htttb.exe PID 2640 wrote to memory of 2500 2640 1htttb.exe hbnhnn.exe PID 2640 wrote to memory of 2500 2640 1htttb.exe hbnhnn.exe PID 2640 wrote to memory of 2500 2640 1htttb.exe hbnhnn.exe PID 2640 wrote to memory of 2500 2640 1htttb.exe hbnhnn.exe PID 2500 wrote to memory of 2448 2500 hbnhnn.exe vpdjv.exe PID 2500 wrote to memory of 2448 2500 hbnhnn.exe vpdjv.exe PID 2500 wrote to memory of 2448 2500 hbnhnn.exe vpdjv.exe PID 2500 wrote to memory of 2448 2500 hbnhnn.exe vpdjv.exe PID 2448 wrote to memory of 2980 2448 vpdjv.exe ppdjd.exe PID 2448 wrote to memory of 2980 2448 vpdjv.exe ppdjd.exe PID 2448 wrote to memory of 2980 2448 vpdjv.exe ppdjd.exe PID 2448 wrote to memory of 2980 2448 vpdjv.exe ppdjd.exe PID 2980 wrote to memory of 1504 2980 ppdjd.exe xxlrfrl.exe PID 2980 wrote to memory of 1504 2980 ppdjd.exe xxlrfrl.exe PID 2980 wrote to memory of 1504 2980 ppdjd.exe xxlrfrl.exe PID 2980 wrote to memory of 1504 2980 ppdjd.exe xxlrfrl.exe PID 1504 wrote to memory of 2456 1504 xxlrfrl.exe tthhbb.exe PID 1504 wrote to memory of 2456 1504 xxlrfrl.exe tthhbb.exe PID 1504 wrote to memory of 2456 1504 xxlrfrl.exe tthhbb.exe PID 1504 wrote to memory of 2456 1504 xxlrfrl.exe tthhbb.exe PID 2456 wrote to memory of 1896 2456 tthhbb.exe 7hbbtt.exe PID 2456 wrote to memory of 1896 2456 tthhbb.exe 7hbbtt.exe PID 2456 wrote to memory of 1896 2456 tthhbb.exe 7hbbtt.exe PID 2456 wrote to memory of 1896 2456 tthhbb.exe 7hbbtt.exe PID 1896 wrote to memory of 1628 1896 7hbbtt.exe 7hhbht.exe PID 1896 wrote to memory of 1628 1896 7hbbtt.exe 7hhbht.exe PID 1896 wrote to memory of 1628 1896 7hbbtt.exe 7hhbht.exe PID 1896 wrote to memory of 1628 1896 7hbbtt.exe 7hhbht.exe PID 1628 wrote to memory of 1604 1628 7hhbht.exe pppdj.exe PID 1628 wrote to memory of 1604 1628 7hhbht.exe pppdj.exe PID 1628 wrote to memory of 1604 1628 7hhbht.exe pppdj.exe PID 1628 wrote to memory of 1604 1628 7hhbht.exe pppdj.exe PID 1604 wrote to memory of 1808 1604 pppdj.exe xrflrrf.exe PID 1604 wrote to memory of 1808 1604 pppdj.exe xrflrrf.exe PID 1604 wrote to memory of 1808 1604 pppdj.exe xrflrrf.exe PID 1604 wrote to memory of 1808 1604 pppdj.exe xrflrrf.exe PID 1808 wrote to memory of 1684 1808 xrflrrf.exe fflffxf.exe PID 1808 wrote to memory of 1684 1808 xrflrrf.exe fflffxf.exe PID 1808 wrote to memory of 1684 1808 xrflrrf.exe fflffxf.exe PID 1808 wrote to memory of 1684 1808 xrflrrf.exe fflffxf.exe PID 1684 wrote to memory of 2300 1684 fflffxf.exe nhthtb.exe PID 1684 wrote to memory of 2300 1684 fflffxf.exe nhthtb.exe PID 1684 wrote to memory of 2300 1684 fflffxf.exe nhthtb.exe PID 1684 wrote to memory of 2300 1684 fflffxf.exe nhthtb.exe PID 2300 wrote to memory of 1160 2300 nhthtb.exe nthhtb.exe PID 2300 wrote to memory of 1160 2300 nhthtb.exe nthhtb.exe PID 2300 wrote to memory of 1160 2300 nhthtb.exe nthhtb.exe PID 2300 wrote to memory of 1160 2300 nhthtb.exe nthhtb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b93ac515ba10ba119cf955f35ff09d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0b93ac515ba10ba119cf955f35ff09d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\bhbthh.exec:\bhbthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\ddjvd.exec:\ddjvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\rlxfxll.exec:\rlxfxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\1htttb.exec:\1htttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\hbnhnn.exec:\hbnhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\vpdjv.exec:\vpdjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\ppdjd.exec:\ppdjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\xxlrfrl.exec:\xxlrfrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\tthhbb.exec:\tthhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\7hbbtt.exec:\7hbbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\7hhbht.exec:\7hhbht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\pppdj.exec:\pppdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\xrflrrf.exec:\xrflrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\fflffxf.exec:\fflffxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\nhthtb.exec:\nhthtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\nthhtb.exec:\nthhtb.exe17⤵
- Executes dropped EXE
PID:1160 -
\??\c:\ddvvj.exec:\ddvvj.exe18⤵
- Executes dropped EXE
PID:2040 -
\??\c:\djpvj.exec:\djpvj.exe19⤵
- Executes dropped EXE
PID:1904 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe20⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ttnttb.exec:\ttnttb.exe21⤵
- Executes dropped EXE
PID:596 -
\??\c:\tnbhnn.exec:\tnbhnn.exe22⤵
- Executes dropped EXE
PID:860 -
\??\c:\3tnbnn.exec:\3tnbnn.exe23⤵
- Executes dropped EXE
PID:1596 -
\??\c:\5vvvv.exec:\5vvvv.exe24⤵
- Executes dropped EXE
PID:1284 -
\??\c:\jjvpv.exec:\jjvpv.exe25⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9llxrxl.exec:\9llxrxl.exe26⤵
- Executes dropped EXE
PID:1120 -
\??\c:\fxrxxrx.exec:\fxrxxrx.exe27⤵
- Executes dropped EXE
PID:928 -
\??\c:\ttntnb.exec:\ttntnb.exe28⤵
- Executes dropped EXE
PID:2840 -
\??\c:\djjvp.exec:\djjvp.exe29⤵
- Executes dropped EXE
PID:848 -
\??\c:\3pjjp.exec:\3pjjp.exe30⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xrxrfrl.exec:\xrxrfrl.exe31⤵
- Executes dropped EXE
PID:3048 -
\??\c:\lfrfrlr.exec:\lfrfrlr.exe32⤵
- Executes dropped EXE
PID:1224 -
\??\c:\hbbthn.exec:\hbbthn.exe33⤵
- Executes dropped EXE
PID:1552 -
\??\c:\btthnn.exec:\btthnn.exe34⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ddpdj.exec:\ddpdj.exe35⤵
- Executes dropped EXE
PID:2628 -
\??\c:\dvjpv.exec:\dvjpv.exe36⤵
- Executes dropped EXE
PID:2504 -
\??\c:\dvpvj.exec:\dvpvj.exe37⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xrfllxl.exec:\xrfllxl.exe38⤵
- Executes dropped EXE
PID:2524 -
\??\c:\flrfllf.exec:\flrfllf.exe39⤵
- Executes dropped EXE
PID:2380 -
\??\c:\5nntbb.exec:\5nntbb.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hnbtbh.exec:\hnbtbh.exe41⤵
- Executes dropped EXE
PID:2308 -
\??\c:\nhhnth.exec:\nhhnth.exe42⤵
- Executes dropped EXE
PID:1256 -
\??\c:\dpdjp.exec:\dpdjp.exe43⤵
- Executes dropped EXE
PID:1456 -
\??\c:\rfrxlrf.exec:\rfrxlrf.exe44⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1fflrfl.exec:\1fflrfl.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\7nbnbn.exec:\7nbnbn.exe46⤵
- Executes dropped EXE
PID:1896 -
\??\c:\bhnnbt.exec:\bhnnbt.exe47⤵
- Executes dropped EXE
PID:2428 -
\??\c:\dpjpj.exec:\dpjpj.exe48⤵
- Executes dropped EXE
PID:2664 -
\??\c:\dvpvj.exec:\dvpvj.exe49⤵
- Executes dropped EXE
PID:1444 -
\??\c:\5lffrfl.exec:\5lffrfl.exe50⤵
- Executes dropped EXE
PID:328 -
\??\c:\1lxxffl.exec:\1lxxffl.exe51⤵
- Executes dropped EXE
PID:632 -
\??\c:\btbhtb.exec:\btbhtb.exe52⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tthhtt.exec:\tthhtt.exe53⤵
- Executes dropped EXE
PID:3000 -
\??\c:\3hhnhn.exec:\3hhnhn.exe54⤵
- Executes dropped EXE
PID:2120 -
\??\c:\pjvvj.exec:\pjvvj.exe55⤵
- Executes dropped EXE
PID:1988 -
\??\c:\pjvdp.exec:\pjvdp.exe56⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rfrlrrl.exec:\rfrlrrl.exe57⤵
- Executes dropped EXE
PID:448 -
\??\c:\xxlrxfr.exec:\xxlrxfr.exe58⤵
- Executes dropped EXE
PID:584 -
\??\c:\tbhnhb.exec:\tbhnhb.exe59⤵
- Executes dropped EXE
PID:860 -
\??\c:\hhttbn.exec:\hhttbn.exe60⤵
- Executes dropped EXE
PID:1072 -
\??\c:\7jjdp.exec:\7jjdp.exe61⤵
- Executes dropped EXE
PID:2076 -
\??\c:\1pjjj.exec:\1pjjj.exe62⤵
- Executes dropped EXE
PID:856 -
\??\c:\ffrxflx.exec:\ffrxflx.exe63⤵
- Executes dropped EXE
PID:3024 -
\??\c:\rxrlflf.exec:\rxrlflf.exe64⤵
- Executes dropped EXE
PID:1068 -
\??\c:\tnthth.exec:\tnthth.exe65⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lfxxrxx.exec:\lfxxrxx.exe66⤵PID:2012
-
\??\c:\lrfxxxr.exec:\lrfxxxr.exe67⤵PID:2724
-
\??\c:\nnbhtb.exec:\nnbhtb.exe68⤵PID:2200
-
\??\c:\ddpdp.exec:\ddpdp.exe69⤵PID:1960
-
\??\c:\ffrxflx.exec:\ffrxflx.exe70⤵PID:1004
-
\??\c:\bbhhnn.exec:\bbhhnn.exe71⤵PID:2252
-
\??\c:\pjpvp.exec:\pjpvp.exe72⤵PID:1928
-
\??\c:\pdvpp.exec:\pdvpp.exe73⤵PID:2588
-
\??\c:\nthhhb.exec:\nthhhb.exe74⤵PID:2528
-
\??\c:\jjdvv.exec:\jjdvv.exe75⤵PID:1672
-
\??\c:\lrlrlff.exec:\lrlrlff.exe76⤵PID:2668
-
\??\c:\tbbhnn.exec:\tbbhnn.exe77⤵PID:572
-
\??\c:\vvvdj.exec:\vvvdj.exe78⤵PID:2696
-
\??\c:\3jppv.exec:\3jppv.exe79⤵PID:2508
-
\??\c:\xrrfxxl.exec:\xrrfxxl.exe80⤵PID:2404
-
\??\c:\1htbhn.exec:\1htbhn.exe81⤵PID:560
-
\??\c:\nttbth.exec:\nttbth.exe82⤵PID:2560
-
\??\c:\vdddv.exec:\vdddv.exe83⤵PID:2548
-
\??\c:\pdjdd.exec:\pdjdd.exe84⤵PID:1256
-
\??\c:\xxrxlrx.exec:\xxrxlrx.exe85⤵PID:1504
-
\??\c:\xxlrlrl.exec:\xxlrlrl.exe86⤵PID:2400
-
\??\c:\xxxxlxx.exec:\xxxxlxx.exe87⤵PID:920
-
\??\c:\9hbbhn.exec:\9hbbhn.exe88⤵PID:2324
-
\??\c:\hnntnb.exec:\hnntnb.exe89⤵PID:1048
-
\??\c:\jvdjj.exec:\jvdjj.exe90⤵PID:1464
-
\??\c:\dpjpp.exec:\dpjpp.exe91⤵PID:844
-
\??\c:\rlrlrxl.exec:\rlrlrxl.exe92⤵PID:1052
-
\??\c:\tnbbhn.exec:\tnbbhn.exe93⤵PID:3012
-
\??\c:\nnbnbb.exec:\nnbnbb.exe94⤵PID:1976
-
\??\c:\hbntbh.exec:\hbntbh.exe95⤵PID:2760
-
\??\c:\1ddpp.exec:\1ddpp.exe96⤵PID:1568
-
\??\c:\llfrxxr.exec:\llfrxxr.exe97⤵PID:536
-
\??\c:\lxlllxf.exec:\lxlllxf.exe98⤵PID:2420
-
\??\c:\nnhhbn.exec:\nnhhbn.exe99⤵PID:580
-
\??\c:\tbnhbb.exec:\tbnhbb.exe100⤵PID:852
-
\??\c:\1vjjp.exec:\1vjjp.exe101⤵PID:652
-
\??\c:\3dpjv.exec:\3dpjv.exe102⤵PID:1284
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe103⤵PID:2832
-
\??\c:\lfxfxxl.exec:\lfxfxxl.exe104⤵PID:2928
-
\??\c:\hbhnhh.exec:\hbhnhh.exe105⤵PID:912
-
\??\c:\tthbnt.exec:\tthbnt.exe106⤵PID:1068
-
\??\c:\vvpdv.exec:\vvpdv.exe107⤵PID:932
-
\??\c:\7dvdj.exec:\7dvdj.exe108⤵PID:2312
-
\??\c:\pjvvp.exec:\pjvvp.exe109⤵PID:1424
-
\??\c:\rrxrfrl.exec:\rrxrfrl.exe110⤵PID:2200
-
\??\c:\9xrrflx.exec:\9xrrflx.exe111⤵PID:2468
-
\??\c:\hhtbnt.exec:\hhtbnt.exe112⤵PID:2876
-
\??\c:\nbnnnn.exec:\nbnnnn.exe113⤵PID:3048
-
\??\c:\dvjjp.exec:\dvjjp.exe114⤵PID:1928
-
\??\c:\vvdjp.exec:\vvdjp.exe115⤵PID:2532
-
\??\c:\3jvvj.exec:\3jvvj.exe116⤵PID:2528
-
\??\c:\fxrxxxl.exec:\fxrxxxl.exe117⤵PID:2396
-
\??\c:\lxxlrff.exec:\lxxlrff.exe118⤵PID:1992
-
\??\c:\bthhbb.exec:\bthhbb.exe119⤵PID:2068
-
\??\c:\5nntbb.exec:\5nntbb.exe120⤵PID:2640
-
\??\c:\bhnhnh.exec:\bhnhnh.exe121⤵PID:2916
-
\??\c:\7jppv.exec:\7jppv.exe122⤵PID:1540
-
\??\c:\jjjpp.exec:\jjjpp.exe123⤵PID:1196
-
\??\c:\jpdpd.exec:\jpdpd.exe124⤵PID:1364
-
\??\c:\llflrfr.exec:\llflrfr.exe125⤵PID:2604
-
\??\c:\3xxflrl.exec:\3xxflrl.exe126⤵PID:1888
-
\??\c:\nnbtbh.exec:\nnbtbh.exe127⤵PID:1456
-
\??\c:\3hbbht.exec:\3hbbht.exe128⤵PID:1588
-
\??\c:\pjvjp.exec:\pjvjp.exe129⤵PID:1644
-
\??\c:\ppjjp.exec:\ppjjp.exe130⤵PID:1612
-
\??\c:\pjvvd.exec:\pjvvd.exe131⤵PID:2664
-
\??\c:\9llrfll.exec:\9llrfll.exe132⤵PID:2100
-
\??\c:\rlrxlxl.exec:\rlrxlxl.exe133⤵PID:328
-
\??\c:\rlrxllx.exec:\rlrxllx.exe134⤵PID:1684
-
\??\c:\nbnnbb.exec:\nbnnbb.exe135⤵PID:2196
-
\??\c:\tnbhnn.exec:\tnbhnn.exe136⤵PID:2388
-
\??\c:\nnhttb.exec:\nnhttb.exe137⤵PID:2120
-
\??\c:\vpjjp.exec:\vpjjp.exe138⤵PID:1988
-
\??\c:\vvpvj.exec:\vvpvj.exe139⤵PID:2888
-
\??\c:\vvppd.exec:\vvppd.exe140⤵PID:448
-
\??\c:\fffffll.exec:\fffffll.exe141⤵PID:584
-
\??\c:\1flxrxf.exec:\1flxrxf.exe142⤵PID:1436
-
\??\c:\5bnthn.exec:\5bnthn.exe143⤵PID:1072
-
\??\c:\hhtbht.exec:\hhtbht.exe144⤵PID:2356
-
\??\c:\bttbbh.exec:\bttbbh.exe145⤵PID:856
-
\??\c:\vvpvj.exec:\vvpvj.exe146⤵PID:3024
-
\??\c:\vpdjv.exec:\vpdjv.exe147⤵PID:928
-
\??\c:\llrfxfr.exec:\llrfxfr.exe148⤵PID:2840
-
\??\c:\9rllrxf.exec:\9rllrxf.exe149⤵PID:2772
-
\??\c:\lxxflll.exec:\lxxflll.exe150⤵PID:2724
-
\??\c:\bhbnht.exec:\bhbnht.exe151⤵PID:2088
-
\??\c:\5thntb.exec:\5thntb.exe152⤵PID:1960
-
\??\c:\7vdjv.exec:\7vdjv.exe153⤵PID:1656
-
\??\c:\pvdjp.exec:\pvdjp.exe154⤵PID:2004
-
\??\c:\rlflrfl.exec:\rlflrfl.exe155⤵PID:1908
-
\??\c:\5rrxrxl.exec:\5rrxrxl.exe156⤵PID:2588
-
\??\c:\xrlxxfx.exec:\xrlxxfx.exe157⤵PID:2188
-
\??\c:\7btbhn.exec:\7btbhn.exe158⤵PID:1672
-
\??\c:\9bttth.exec:\9bttth.exe159⤵PID:2668
-
\??\c:\pjdjp.exec:\pjdjp.exe160⤵PID:2296
-
\??\c:\jvjdd.exec:\jvjdd.exe161⤵PID:1696
-
\??\c:\pjdvj.exec:\pjdvj.exe162⤵PID:2696
-
\??\c:\lfrfffl.exec:\lfrfffl.exe163⤵PID:2380
-
\??\c:\rrlfrxl.exec:\rrlfrxl.exe164⤵PID:560
-
\??\c:\bnbntn.exec:\bnbntn.exe165⤵PID:2880
-
\??\c:\bntnnh.exec:\bntnnh.exe166⤵PID:2548
-
\??\c:\hhtbht.exec:\hhtbht.exe167⤵PID:344
-
\??\c:\vvppv.exec:\vvppv.exe168⤵PID:2444
-
\??\c:\vvjdd.exec:\vvjdd.exe169⤵PID:2612
-
\??\c:\fffrrxr.exec:\fffrrxr.exe170⤵PID:920
-
\??\c:\rxfffxf.exec:\rxfffxf.exe171⤵PID:1604
-
\??\c:\frffllr.exec:\frffllr.exe172⤵PID:1048
-
\??\c:\1hbbhn.exec:\1hbbhn.exe173⤵PID:1444
-
\??\c:\nbhhhb.exec:\nbhhhb.exe174⤵PID:844
-
\??\c:\vjjjp.exec:\vjjjp.exe175⤵PID:632
-
\??\c:\9vpjj.exec:\9vpjj.exe176⤵PID:1144
-
\??\c:\vjvpp.exec:\vjvpp.exe177⤵PID:3000
-
\??\c:\1fxlxxf.exec:\1fxlxxf.exe178⤵PID:2760
-
\??\c:\frxxffl.exec:\frxxffl.exe179⤵PID:1568
-
\??\c:\xrfffll.exec:\xrfffll.exe180⤵PID:536
-
\??\c:\1htttn.exec:\1htttn.exe181⤵PID:2420
-
\??\c:\nbhttb.exec:\nbhttb.exe182⤵PID:580
-
\??\c:\vpjpv.exec:\vpjpv.exe183⤵PID:1800
-
\??\c:\dpddv.exec:\dpddv.exe184⤵PID:652
-
\??\c:\lxfrxrx.exec:\lxfrxrx.exe185⤵PID:2076
-
\??\c:\xrfxxrr.exec:\xrfxxrr.exe186⤵PID:2832
-
\??\c:\xlxxxff.exec:\xlxxxff.exe187⤵PID:2928
-
\??\c:\3nbtth.exec:\3nbtth.exe188⤵PID:912
-
\??\c:\ntnttb.exec:\ntnttb.exe189⤵PID:1068
-
\??\c:\bbtnhh.exec:\bbtnhh.exe190⤵PID:932
-
\??\c:\ppppd.exec:\ppppd.exe191⤵PID:2312
-
\??\c:\frxrrfl.exec:\frxrrfl.exe192⤵PID:1424
-
\??\c:\1lxflfr.exec:\1lxflfr.exe193⤵PID:2064
-
\??\c:\lxfxffr.exec:\lxfxffr.exe194⤵PID:480
-
\??\c:\bttnnh.exec:\bttnnh.exe195⤵PID:1004
-
\??\c:\5bnnnt.exec:\5bnnnt.exe196⤵PID:2676
-
\??\c:\jvppv.exec:\jvppv.exe197⤵PID:2252
-
\??\c:\1dppp.exec:\1dppp.exe198⤵PID:2520
-
\??\c:\rfrllll.exec:\rfrllll.exe199⤵PID:2596
-
\??\c:\xrflxlf.exec:\xrflxlf.exe200⤵PID:2628
-
\??\c:\bnnnnn.exec:\bnnnnn.exe201⤵PID:2632
-
\??\c:\1tthtb.exec:\1tthtb.exe202⤵PID:2008
-
\??\c:\7pjvd.exec:\7pjvd.exe203⤵PID:572
-
\??\c:\ddvjd.exec:\ddvjd.exe204⤵PID:2640
-
\??\c:\vpddv.exec:\vpddv.exe205⤵PID:2404
-
\??\c:\fxllllr.exec:\fxllllr.exe206⤵PID:2172
-
\??\c:\7frrllr.exec:\7frrllr.exe207⤵PID:2044
-
\??\c:\bthhtb.exec:\bthhtb.exe208⤵PID:2456
-
\??\c:\tnhtth.exec:\tnhtth.exe209⤵PID:1524
-
\??\c:\ttbnbt.exec:\ttbnbt.exe210⤵PID:1256
-
\??\c:\9jjpv.exec:\9jjpv.exe211⤵PID:1504
-
\??\c:\pdvjv.exec:\pdvjv.exe212⤵PID:1628
-
\??\c:\1xxfxrf.exec:\1xxfxrf.exe213⤵PID:644
-
\??\c:\nbnthb.exec:\nbnthb.exe214⤵PID:2428
-
\??\c:\vjpdd.exec:\vjpdd.exe215⤵PID:1704
-
\??\c:\ntthht.exec:\ntthht.exe216⤵PID:844
-
\??\c:\vdvvv.exec:\vdvvv.exe217⤵PID:632
-
\??\c:\9xrlrxr.exec:\9xrlrxr.exe218⤵PID:1144
-
\??\c:\xrfrxrf.exec:\xrfrxrf.exe219⤵PID:3000
-
\??\c:\vdpdp.exec:\vdpdp.exe220⤵PID:2760
-
\??\c:\lrfxfrf.exec:\lrfxfrf.exe221⤵PID:1568
-
\??\c:\lxlrrrx.exec:\lxlrrrx.exe222⤵PID:536
-
\??\c:\pdjpv.exec:\pdjpv.exe223⤵PID:2420
-
\??\c:\fxrlrrf.exec:\fxrlrrf.exe224⤵PID:580
-
\??\c:\5frxxfr.exec:\5frxxfr.exe225⤵PID:3068
-
\??\c:\7hbbhh.exec:\7hbbhh.exe226⤵PID:652
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe227⤵PID:2076
-
\??\c:\nhtbht.exec:\nhtbht.exe228⤵PID:2832
-
\??\c:\vvjpd.exec:\vvjpd.exe229⤵PID:1592
-
\??\c:\vvppp.exec:\vvppp.exe230⤵PID:912
-
\??\c:\lrfxxrr.exec:\lrfxxrr.exe231⤵PID:1068
-
\??\c:\thbbbh.exec:\thbbbh.exe232⤵PID:932
-
\??\c:\3htthh.exec:\3htthh.exe233⤵PID:2312
-
\??\c:\vvjpj.exec:\vvjpj.exe234⤵PID:1424
-
\??\c:\7flxfxf.exec:\7flxfxf.exe235⤵PID:2468
-
\??\c:\vddvv.exec:\vddvv.exe236⤵PID:2904
-
\??\c:\jvjjp.exec:\jvjjp.exe237⤵PID:1656
-
\??\c:\rlxflff.exec:\rlxflff.exe238⤵PID:2676
-
\??\c:\hthhnn.exec:\hthhnn.exe239⤵PID:2600
-
\??\c:\dpdpd.exec:\dpdpd.exe240⤵PID:2084
-
\??\c:\xrflrrx.exec:\xrflrrx.exe241⤵PID:2452
-
\??\c:\1hbbnb.exec:\1hbbnb.exe242⤵PID:2524